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Standard Operating Procedure 


Subject: Privacy and Confidentiality at Medical Sheltering Site 


1. Introduction 
The purpose of this Standard Operating Procedure (SOP) is to establish a 
procedure to Medical Sheltering employees that ensure client privacy and 
confidentiality, while complying with federal regulations as defined in the Health 
Insurance Portability and Accountability Act (HIPAA) and all State of California 
rules and regulations regarding the use and disclosure of Protected Health 


Information 


2. Definitions 


(PHS) of all clients served by the Medical Sheltering program. 


1. Protected Health Information can be defined as any health information, 
created, used, stored, or transmitted by the Medical Sheltering program 
that can be used to describe the health and identity of the individual 


o Health information identifies includes (but not limited to): 


[e) 


e) 
e) 
e) 
e) 


Client name 

Client date of birth 

Client address 

Client phone number 

Any information that identifies the client 


2. HIPAA permits the use and disclosure of client information without prior 
client Authorization to: 


e) 
1) 
e) 


Provide treatment 

Conduct healthcare operations 

Other limited and specified instances, such as reporting for public 
health purposes or when required by law 


3. Procedure 


All Medical Sheltering employees shall not share, release, disclose, disseminate, 
make available, transfer, or otherwise communicate orally, in writing, or by 
electronic or other means, personal information to a third party without the 
consent by the client 


1. Release of Information: 

o With few exceptions, clients have the right to access, inspect and 
request copies of their PHI. Clients may request paper-based copies of 
their physical health information, mental health information and HMIS 
case notes. 

o Valid written authorizations may be completed on the DHS 
“Authorization for Use” and “Disclosure of Protected Health 
Information” form. 

o The following must be present in release form: 


A 
2. 
3: 
4. 
5. It must be signed by the client, legal representative, or 


It must be written 

It must describe what is to be released 

It must state that the client authorizes the Medical Shelter to 
release the information 

It must be dated 


guardian 


2. Safeguarding 
o Medical Sheltering staff shall conduct every discussion involving 
clients in a discreet and confidential manner 


3. Destroying PHI 
o Medical Sheltering staff shall shred hardcopy documents that 
contain PHI 
o Staff shall not throw PHI directly in the trash or recycling bin 


